review updates

Signed-off-by: grokspawn <jordan@nimblewidget.com>

Author: grokspawn

api/v1/clusterextension_types.go

@@ -130,10 +130,19 @@ const (
 //
 // +union
 // +kubebuilder:validation:XValidation:rule="has(self.sourceType) && self.sourceType == 'Catalog' ? has(self.catalog) : !has(self.catalog)",message="catalog is required when sourceType is Catalog, and forbidden otherwise"
-// +kubebuilder:validation:XValidation:rule="has(self.sourceType) && self.sourceType == 'OCIImage' ? has(self.ociImage) : !has(self.ociImage)",message="ociImage is required when sourceType is OCIImage, and forbidden otherwise"
+// <opcon:experimental:validation:XValidation:rule="has(self.sourceType) && self.sourceType == 'OCIImage' ? self.ociImage.ref.size() != 0 : self.ociImage.ref.size() == 0",message="ociImage is required when sourceType is OCIImage, and forbidden otherwise">
 type SourceConfig struct {
 	// sourceType is required and specifies the type of install source.
 	//
+	// <opcon:standard:description>
+	// The allowed value is "Catalog".
+	//
+	// When set to "Catalog", information for determining the appropriate bundle of content to install
+	// is fetched from ClusterCatalog resources on the cluster.
+	// When using the Catalog sourceType, the catalog field must also be set.
+	// </opcon:standard:description>
+	//
+	// <opcon:experimental:description>
 	// The allowed values are "Catalog" and "OCIImage".
 	//
 	// When set to "OCIImage", the bundle image is used directly. Direct sources do not perform
@@ -142,9 +151,11 @@ type SourceConfig struct {
 	// When set to "Catalog", information for determining the appropriate bundle of content to install
 	// is fetched from ClusterCatalog resources on the cluster.
 	// When using the Catalog sourceType, the catalog field must also be set.
+	// </opcon:experimental:description>
 	//
 	// +unionDiscriminator
-	// +kubebuilder:validation:Enum:="Catalog";"OCIImage"
+	// +kubebuilder:validation:Enum:="Catalog"
+	// <opcon:experimental:validation:Enum=Catalog;OCIImage>
 	// +required
 	SourceType string `json:"sourceType"`
 
@@ -155,27 +166,24 @@ type SourceConfig struct {
 	Catalog *CatalogFilter `json:"catalog,omitempty"`
 
 	// ociImage configures a bundle image to install directly.
+	// <opcon:experimental:description>
 	// They do not provide catalog dependency resolution or upgrade safety.
-	//
+	// </opcon:experimental:description>
+	// <opcon:experimental>
 	// +optional
-	OCIImage *OCIImageSource `json:"ociImage,omitempty"`
+	OCIImage OCIImageSource `json:"ociImage,omitzero"`
 }
 
 // OCIImageSource identifies a bundle image to install directly from an OCI registry.
+// +kubebuilder:validation:MinProperties:=1
 type OCIImageSource struct {
 	// ref is a Docker-style image reference with a tag or digest.
 	//
 	// +required
 	// +kubebuilder:validation:MaxLength:=1000
-	// +kubebuilder:validation:XValidation:rule="self.matches(\"^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])((\\\\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(:[0-9]+)?\\\\b\")",message="must start with a valid domain"
-	// +kubebuilder:validation:XValidation:rule="self.find(\"(\\\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?((\\\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?)+)?)\") != \"\"",message="a valid image name is required"
-	// +kubebuilder:validation:XValidation:rule="self.find(\"(@.*:)\") != \"\" || self.find(\":.*$\") != \"\"",message="must end with a digest or a tag"
-	// +kubebuilder:validation:XValidation:rule="self.find(\"(@.*:)\") == \"\" ? (self.find(\":.*$\") != \"\" ? self.find(\":.*$\").substring(1).size() <= 127 : true) : true",message="tag is invalid"
-	// +kubebuilder:validation:XValidation:rule="self.find(\"(@.*:)\") == \"\" ? (self.find(\":.*$\") != \"\" ? self.find(\":.*$\").matches(\":[\\\\w][\\\\w.-]*$\") : true) : true",message="tag is invalid"
-	// +kubebuilder:validation:XValidation:rule="self.find(\"(@.*:)\") != \"\" ? self.find(\"(@.*:)\").matches(\"(@[A-Za-z][A-Za-z0-9]*([-_+.][A-Za-z][A-Za-z0-9]*)*[:])\") : true",message="digest algorithm is not valid"
-	// +kubebuilder:validation:XValidation:rule="self.find(\"(@.*:)\") != \"\" ? self.find(\":.*$\").substring(1).size() >= 32 : true",message="digest is not valid"
-	// +kubebuilder:validation:XValidation:rule="self.find(\"(@.*:)\") != \"\" ? self.find(\":.*$\").matches(\":[0-9A-Fa-f]*$\") : true",message="digest is not valid"
-	Ref string `json:"ref"`
+	// +kubebuilder:validation:MinLength:=1
+	// +kubebuilder:validation:XValidation:rule="self.matches(\"^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?(:[0-9]+)?/[a-z0-9]+([._-][a-z0-9]+)*(/[a-z0-9]+([._-][a-z0-9]+)*)*(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,126}|@[A-Za-z][A-Za-z0-9+._-]*:[0-9A-Fa-f]{32,})$\")",message="must be a complete image reference with a valid repository and tag or digest"
+	Ref string `json:"ref,omitempty"`
 }
 
 // ClusterExtensionInstallConfig is a union which selects the clusterExtension installation config.

api/v1/zz_generated.deepcopy.go

@@ -664,6 +664,7 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
 		controllers.ValidateClusterExtension(
 			controllers.ServiceAccountDeprecationWarning(),
 			controllers.DirectBundleRequiresBoxcutter(),
+			controllers.ValidateDirectBundleSource(),
 		),
 		controllers.MigrateStorage(storageMigrator),
 		controllers.RetrieveRevisionStates(revisionStatesGetter),
@@ -753,6 +754,7 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
 		controllers.ValidateClusterExtension(
 			controllers.ServiceAccountDeprecationWarning(),
 			controllers.DirectBundleRequiresBoxcutter(),
+			controllers.ValidateDirectBundleSource(),
 		),
 		controllers.RetrieveRevisionStates(revisionStatesGetter),
 		controllers.ResolveBundle(c.resolver, c.mgr.GetClient()),

applyconfigurations/api/v1/sourceconfig.go

@@ -463,14 +463,15 @@ _Appears in:_
 
 OCIImageSource identifies a bundle image to install directly from an OCI registry.
 
-
+_Validation:_
+- MinProperties: 1
 
 _Appears in:_
 - [SourceConfig](#sourceconfig)
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `ref` _string_ | ref is a Docker-style image reference with a tag or digest. |  | MaxLength: 1000 <br />Required: \{\} <br /> |
+| `ref` _string_ | ref is a Docker-style image reference with a tag or digest. |  | MaxLength: 1000 <br />MinLength: 1 <br />Required: \{\} <br /> |
 
 
 #### ObjectSelector
@@ -622,16 +623,18 @@ _Appears in:_
 
 SourceConfig is a discriminated union which selects the installation source.
 
+<opcon:experimental:validation:XValidation:rule="has(self.sourceType) && self.sourceType == 'OCIImage' ? self.ociImage.ref.size() != 0 : self.ociImage.ref.size() == 0",message="ociImage is required when sourceType is OCIImage, and forbidden otherwise">
+
 
 
 _Appears in:_
 - [ClusterExtensionSpec](#clusterextensionspec)
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `sourceType` _string_ | sourceType is required and specifies the type of install source.<br />The allowed values are "Catalog" and "OCIImage".<br />When set to "OCIImage", the bundle image is used directly. Direct sources do not perform<br />dependency resolution and are only supported by the Boxcutter runtime.<br />When set to "Catalog", information for determining the appropriate bundle of content to install<br />is fetched from ClusterCatalog resources on the cluster.<br />When using the Catalog sourceType, the catalog field must also be set. |  | Enum: [Catalog OCIImage] <br />Required: \{\} <br /> |
+| `sourceType` _string_ | sourceType is required and specifies the type of install source.<br /><opcon:standard:description><br />The allowed value is "Catalog".<br />When set to "Catalog", information for determining the appropriate bundle of content to install<br />is fetched from ClusterCatalog resources on the cluster.<br />When using the Catalog sourceType, the catalog field must also be set.<br /></opcon:standard:description><br /><opcon:experimental:description><br />The allowed values are "Catalog" and "OCIImage".<br />When set to "OCIImage", the bundle image is used directly. Direct sources do not perform<br />dependency resolution and are only supported by the Boxcutter runtime.<br />When set to "Catalog", information for determining the appropriate bundle of content to install<br />is fetched from ClusterCatalog resources on the cluster.<br />When using the Catalog sourceType, the catalog field must also be set.<br /></opcon:experimental:description><br /><opcon:experimental:validation:Enum=Catalog;OCIImage> |  | Enum: [Catalog] <br />Required: \{\} <br /> |
 | `catalog` _[CatalogFilter](#catalogfilter)_ | catalog configures how information is sourced from a catalog.<br />It is required when sourceType is "Catalog", and forbidden otherwise. |  | Optional: \{\} <br /> |
-| `ociImage` _[OCIImageSource](#ociimagesource)_ | ociImage configures a bundle image to install directly.<br />They do not provide catalog dependency resolution or upgrade safety. |  | Optional: \{\} <br /> |
+| `ociImage` _[OCIImageSource](#ociimagesource)_ | ociImage configures a bundle image to install directly.<br /><opcon:experimental:description><br />They do not provide catalog dependency resolution or upgrade safety.<br /></opcon:experimental:description><br /><opcon:experimental> |  | MinProperties: 1 <br />Optional: \{\} <br /> |
 
 
 #### SourceType

cmd/operator-controller/main.go

@@ -474,39 +474,20 @@ spec:
                   ociImage:
                     description: |-
                       ociImage configures a bundle image to install directly.
+
                       They do not provide catalog dependency resolution or upgrade safety.
+                    minProperties: 1
                     properties:
                       ref:
                         description: ref is a Docker-style image reference with a
                           tag or digest.
                         maxLength: 1000
+                        minLength: 1
                         type: string
                         x-kubernetes-validations:
-                        - message: must start with a valid domain
-                          rule: self.matches("^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])((\\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(:[0-9]+)?\\b")
-                        - message: a valid image name is required
-                          rule: self.find("(\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?((\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?)+)?)")
-                            != ""
-                        - message: must end with a digest or a tag
-                          rule: self.find("(@.*:)") != "" || self.find(":.*$") !=
-                            ""
-                        - message: tag is invalid
-                          rule: 'self.find("(@.*:)") == "" ? (self.find(":.*$") !=
-                            "" ? self.find(":.*$").substring(1).size() <= 127 : true)
-                            : true'
-                        - message: tag is invalid
-                          rule: 'self.find("(@.*:)") == "" ? (self.find(":.*$") !=
-                            "" ? self.find(":.*$").matches(":[\\w][\\w.-]*$") : true)
-                            : true'
-                        - message: digest algorithm is not valid
-                          rule: 'self.find("(@.*:)") != "" ? self.find("(@.*:)").matches("(@[A-Za-z][A-Za-z0-9]*([-_+.][A-Za-z][A-Za-z0-9]*)*[:])")
-                            : true'
-                        - message: digest is not valid
-                          rule: 'self.find("(@.*:)") != "" ? self.find(":.*$").substring(1).size()
-                            >= 32 : true'
-                        - message: digest is not valid
-                          rule: 'self.find("(@.*:)") != "" ? self.find(":.*$").matches(":[0-9A-Fa-f]*$")
-                            : true'
+                        - message: must be a complete image reference with a valid
+                            repository and tag or digest
+                          rule: self.matches("^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?(:[0-9]+)?/[a-z0-9]+([._-][a-z0-9]+)*(/[a-z0-9]+([._-][a-z0-9]+)*)*(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,126}|@[A-Za-z][A-Za-z0-9+._-]*:[0-9A-Fa-f]{32,})$")
                     required:
                     - ref
                     type: object
@@ -534,10 +515,6 @@ spec:
                     otherwise
                   rule: 'has(self.sourceType) && self.sourceType == ''Catalog'' ?
                     has(self.catalog) : !has(self.catalog)'
-                - message: ociImage is required when sourceType is OCIImage, and forbidden
-                    otherwise
-                  rule: 'has(self.sourceType) && self.sourceType == ''OCIImage'' ?
-                    has(self.ociImage) : !has(self.ociImage)'
             required:
             - namespace
             - source

docs/api-reference/olmv1-api-reference.md

@@ -423,60 +423,17 @@ spec:
                     required:
                     - packageName
                     type: object
-                  ociImage:
-                    description: |-
-                      ociImage configures a bundle image to install directly.
-                      They do not provide catalog dependency resolution or upgrade safety.
-                    properties:
-                      ref:
-                        description: ref is a Docker-style image reference with a
-                          tag or digest.
-                        maxLength: 1000
-                        type: string
-                        x-kubernetes-validations:
-                        - message: must start with a valid domain
-                          rule: self.matches("^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])((\\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(:[0-9]+)?\\b")
-                        - message: a valid image name is required
-                          rule: self.find("(\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?((\\/[a-z0-9]+((([._]|__|[-]*)[a-z0-9]+)+)?)+)?)")
-                            != ""
-                        - message: must end with a digest or a tag
-                          rule: self.find("(@.*:)") != "" || self.find(":.*$") !=
-                            ""
-                        - message: tag is invalid
-                          rule: 'self.find("(@.*:)") == "" ? (self.find(":.*$") !=
-                            "" ? self.find(":.*$").substring(1).size() <= 127 : true)
-                            : true'
-                        - message: tag is invalid
-                          rule: 'self.find("(@.*:)") == "" ? (self.find(":.*$") !=
-                            "" ? self.find(":.*$").matches(":[\\w][\\w.-]*$") : true)
-                            : true'
-                        - message: digest algorithm is not valid
-                          rule: 'self.find("(@.*:)") != "" ? self.find("(@.*:)").matches("(@[A-Za-z][A-Za-z0-9]*([-_+.][A-Za-z][A-Za-z0-9]*)*[:])")
-                            : true'
-                        - message: digest is not valid
-                          rule: 'self.find("(@.*:)") != "" ? self.find(":.*$").substring(1).size()
-                            >= 32 : true'
-                        - message: digest is not valid
-                          rule: 'self.find("(@.*:)") != "" ? self.find(":.*$").matches(":[0-9A-Fa-f]*$")
-                            : true'
-                    required:
-                    - ref
-                    type: object
                   sourceType:
                     description: |-
                       sourceType is required and specifies the type of install source.
 
-                      The allowed values are "Catalog" and "OCIImage".
-
-                      When set to "OCIImage", the bundle image is used directly. Direct sources do not perform
-                      dependency resolution and are only supported by the Boxcutter runtime.
+                      The allowed value is "Catalog".
 
                       When set to "Catalog", information for determining the appropriate bundle of content to install
                       is fetched from ClusterCatalog resources on the cluster.
                       When using the Catalog sourceType, the catalog field must also be set.
                     enum:
                     - Catalog
-                    - OCIImage
                     type: string
                 required:
                 - sourceType
@@ -486,10 +443,6 @@ spec:
                     otherwise
                   rule: 'has(self.sourceType) && self.sourceType == ''Catalog'' ?
                     has(self.catalog) : !has(self.catalog)'
-                - message: ociImage is required when sourceType is OCIImage, and forbidden
-                    otherwise
-                  rule: 'has(self.sourceType) && self.sourceType == ''OCIImage'' ?
-                    has(self.ociImage) : !has(self.ociImage)'
             required:
             - namespace
             - source